Network configurations for large data center networks are often specified at a centralized controller. The controller can program switches, routers, servers, and elements in the network according to the specified network configurations. Network configurations are inherently very complex, and involve low level as well as high level configurations of several layers of the network such as access policies, forwarding policies, routing policies, security policies, QoS policies, etc. Given such complexity, the network configuration process is error prone. The configurations are defined on a controller and can reflect an intent specification for the network. In many cases, the configurations can contain errors and inconsistencies that are often extremely difficult to identify and may create significant problems in the network. Furthermore, for various reasons, the configurations defined on the controller may be or become inconsistent with the implementation of the intent specification on network nodes.